How important is Burp Suite for the OSCP exam?
Critical for the web-exploitation portion of standalone targets and useful throughout. Burp Suite Community Edition is sufficient for OSCP because the exam targets do not require Pro features like the active scanner; however, Burp Pro pays back its $475 annual cost during preparation by accelerating your learning curve on chained exploitation. Candidates who can use Repeater, Intruder, Decoder, and the Proxy match-and-replace rules fluently move through web targets in minutes that take untrained candidates hours.
The single tool that separates candidates who finish web-based exam targets in under an hour from candidates who never finish them is Burp Suite. The OSCP, eJPT, PNPT, eWPT, OSWE, and the practical components of CEH all assume working fluency with Burp's core workflow. Yet the official PEN-200 course material covers Burp lightly, and candidates routinely arrive at the exam with surface-level proficiency that breaks down under time pressure. This guide treats Burp not as a tool to be memorised but as a working environment to be inhabited, and walks through the workflows that pay back during certification exams and in real engagements alike.
Why Burp dominates the certification toolchain
Two facts explain why Burp Suite is the de facto standard. First, PortSwigger Web Security Academy, the company's free training platform, is genuinely the best web security training in the industry. Every certification provider's web exploitation curriculum either copies the Academy's structure or recommends it directly. Second, the tool itself is built around an interception proxy model that maps cleanly onto how the OWASP Top 10 vulnerabilities are exploited. Once you can intercept, modify, and replay an HTTP request in Burp, you can chain almost any web vulnerability you encounter.
Interception proxy -- a man-in-the-middle proxy that sits between your browser and the target server, allowing you to inspect and modify every HTTP and HTTPS request and response in flight. Burp's Proxy tab is the workflow's centre of gravity.
Repeater -- a Burp feature that takes a captured request and lets you modify and resend it manually. Repeater is the single most-used Burp feature on the OSCP and OSWE exams because it lets you iterate exploitation payloads against a single endpoint without re-running the full attack chain.
The two product tiers candidates encounter are Burp Suite Community Edition (free, no active scanner, throttled Intruder) and Burp Suite Professional ($475 per year, full active scanner, unthrottled Intruder, Burp Collaborator). For OSCP, Community is sufficient. For OSWE, Pro is highly recommended because the active scanner finds chained vulnerabilities Community cannot. For real engagements, Pro is non-negotiable.
"Burp Suite is not a vulnerability scanner. It is a manual testing platform that happens to include a scanner. The scanner is the least interesting part. The interception proxy and Repeater are where every serious finding actually gets confirmed." -- Dafydd Stuttard, founder of PortSwigger and author of The Web Application Hacker's Handbook
The Burp workflow you must master
Every Burp engagement follows the same six-step workflow. Memorising the steps and practising them until they are automatic is the single highest-leverage thing you can do to prepare for a web-heavy certification.
- Configure the proxy and CA certificate. Set Burp's listener on
127.0.0.1:8080. Install Burp's CA certificate in the browser so HTTPS interception works. Use a dedicated Firefox profile with the FoxyProxy extension to switch on and off Burp routing without disrupting your normal browsing. - Map the application. Browse the target end to end with Burp set to passive crawl. The
Targettab's site map will populate with discovered endpoints. Right-click the site root and select Add to scope so subsequent tools restrict their actions to in-scope hosts. - Identify dynamic parameters. Use the
HTTP historytab to identify endpoints with user-controlled parameters. Send promising requests toRepeaterfor manual exploration. - Test parameters in Repeater. Modify each parameter individually and observe the response. Look for reflected input (XSS candidates), differential responses (SQL injection candidates), and error messages (information disclosure candidates).
- Automate with Intruder. When you find a parameter worth attacking systematically, send the request to
Intruder, mark the payload position, load a wordlist, and run the attack. The four attack types (Sniper, Battering Ram, Pitchfork, Cluster Bomb) each have specific use cases. - Confirm the finding. Use
Decoderto manipulate encodings,Comparerto diff responses, andLogger++(an extension) to maintain a complete history. Take screenshots for the report.
Configuring Burp for exam conditions
The exam clock is unforgiving. Pre-stage your Burp environment before you start. Build a .json configuration file that contains your match-and-replace rules, scope settings, and Intruder payload positions, and load it at the start of each session. The .json configuration export and import functions are under Settings > Project options.
| Burp tool | Primary use on certs | Time saved per finding |
|---|---|---|
| Proxy intercept | Capture and pause requests | 5 to 15 minutes |
| Repeater | Manual payload iteration | 10 to 30 minutes |
| Intruder | Brute force, fuzzing | 30 minutes to hours |
| Decoder | Encoding transformations | 5 minutes |
| Comparer | Differential analysis | 10 minutes |
| Collaborator (Pro) | Out-of-band exploitation | Enables findings otherwise impossible |
Repeater: the heart of manual web testing
If you only learn one Burp tool deeply, learn Repeater. Repeater takes any captured HTTP request and lets you edit it character by character before re-sending. The skill is not the tool; the skill is knowing what to change and why.
Critical Repeater patterns. Modify a single parameter at a time. Watch for changes in response status code, response length, response time, and response body content. Use the Render tab to view the response as a browser would render it. Use the Inspector panel (introduced in Burp 2022.x) to expand parameter views into a structured editor.
For SQL injection testing, the canonical Repeater workflow is:
- Send a baseline request and note the response.
- Append a single quote (
') to the parameter and observe whether the response differs. - If it does, append
' OR 1=1 --and observe. - If the response changes again, build a UNION-based payload using
' UNION SELECT NULL, NULL, NULL --(adjusting column count until it succeeds). - Replace the
NULLs with actual extraction queries againstinformation_schema.tables,information_schema.columns, and target tables.
For server-side template injection (SSTI) testing, the canonical workflow uses a polyglot payload like ${{<%[%'"}}%\ and watches for differential template engine errors. PayloadsAllTheThings on GitHub maintains the most comprehensive SSTI payload list and should be cloned locally before any exam.
A worked Repeater example
Consider a fictional standalone target on an OSCP exam where you find an authentication endpoint at /api/login that accepts a POST body of {"user":"admin","pass":"password"}. You send it to Repeater. Changing pass to ' OR 1=1 -- produces an authentication failure. Changing user to admin' OR 1=1 -- produces a different response with a session token. You now have an authentication bypass via SQL injection in the username parameter, and Repeater let you confirm it in 90 seconds. This pattern is recoverable across hundreds of similar findings.
Intruder: structured attacks at scale
Intruder is Burp's payload automation engine. The Community Edition throttles Intruder to roughly one request per second, which is usable on the OSCP but painful on OSWE. The four attack types every certification candidate must know are:
- Sniper. Single payload position, single payload list. Use for fuzzing one parameter at a time.
- Battering Ram. Multiple payload positions, single payload list, same payload at every position simultaneously. Rarely used.
- Pitchfork. Multiple payload positions, multiple payload lists, same index at each position. Useful for credential stuffing where username and password are paired.
- Cluster Bomb. Multiple payload positions, multiple payload lists, every combination. Most expensive but most thorough.
The most common Intruder mistake is using Cluster Bomb when Sniper would suffice. Cluster Bomb with two 10,000-entry lists produces 100 million requests, which will not finish before the exam clock does. Match the attack type to the actual problem.
"The candidate who pulls out Cluster Bomb on a single-parameter SQL injection has misunderstood the tool. Sniper with a focused payload list of 200 SQL injection signatures takes 200 seconds. Cluster Bomb takes 200 hours. Choose deliberately." -- James Kettle, Director of Research at PortSwigger and author of multiple OWASP Top 10 entries
Recommended payload lists
Three payload list sources cover roughly 95 percent of certification-level attacks.
- PayloadsAllTheThings on GitHub. Comprehensive coverage of every common web vulnerability class.
- SecLists by Daniel Miessler. The dictionary collection that ships with Kali. Use the Discovery directory for content discovery, the Fuzzing directory for parameter fuzzing, and the Passwords directory for credential attacks.
- FuzzDB. Smaller, more focused, and frequently updated. Particularly strong for unusual encodings and specific framework attacks.
Burp extensions that earn their keep
Burp's extension ecosystem is mature and many of the best extensions are free. The ones worth installing before any certification exam are:
- Logger++ -- comprehensive logging with filtering and search across all Burp tools.
- Param Miner -- discovers hidden HTTP parameters by guessing common parameter names against the target.
- Active Scan++ -- adds checks the built-in scanner does not perform, including HTTP cache poisoning and host header injection.
- Turbo Intruder -- a high-performance Intruder replacement that bypasses Community Edition's rate limit and supports custom Python scripts.
- Autorize -- automated authorisation testing that compares responses for two user sessions side by side.
Turbo Intruder deserves special mention. The extension's ability to send 30,000 requests per second on a local lab and its scripting interface make it the only Community-Edition-compatible way to run race-condition attacks, which appear regularly on OSWE-style exams. James Kettle's original race-condition research at PortSwigger is built on Turbo Intruder and reading his published advisories is the fastest way to internalise the technique.
Real-world breaches and Burp-style exploitation
The 2017 Equifax breach was triggered by an unpatched Apache Struts deserialisation vulnerability. A penetration tester with Burp could have detected the same vulnerability class in minutes by sending a malformed Content-Type header to the target endpoint and observing the differential error response. The 2021 GitHub OAuth-token exfiltration involved a chained vulnerability in Travis CI that a Burp-equipped tester could have demonstrated end to end. The 2023 MOVEit Transfer breach exploited a SQL injection in a file-transfer application; the same pattern is testable in Burp's Repeater within seconds of finding the vulnerable parameter.
The point is not that Burp would have prevented these breaches. The point is that Burp-based testing methodology is the same methodology defenders need to apply continuously to find these vulnerabilities before attackers do. Certification exams test that methodology directly.
A four-week Burp mastery plan
The plan below assumes 8 to 10 hours per week and is designed to produce exam-grade Burp fluency.
- Week 1. Install Burp Community. Complete the first 30 PortSwigger Web Security Academy labs in the Apprentice tier. Focus on Repeater workflow and proxy interception.
- Week 2. Complete 30 Practitioner-tier labs covering authentication, access control, and SQL injection. Practise Intruder Sniper attacks against the Authentication labs.
- Week 3. Complete 20 Practitioner-tier labs on cross-site scripting, SSRF, and XXE. Install Logger++ and Param Miner. Practise reading the HTTP history with filters.
- Week 4. Complete 10 Expert-tier labs and one full chained-exploitation lab end to end. Take a Hack The Box web target under timed conditions. Document your workflow in a personal Burp playbook.
The 100-lab investment in Web Security Academy is the single highest-return preparation activity for any web-heavy certification. Daniel Miessler, founder of the Unsupervised Learning podcast and a long-time application security practitioner, has said publicly that the Academy is the strongest free resource in the entire field, and that finishing it produces practitioners who outperform peers with two years of on-the-job experience.
How professional testers actually use Burp on engagements
Beyond certifications, the Burp workflow that produces real findings on real engagements differs from the academic workflow in three important ways. First, professional testers maintain detailed engagement notes inside Burp's Project Notes panel, often including timestamps and command outputs that later become the report's evidence trail. Second, professional testers configure Burp's Match and replace rules to inject canary tokens into every outbound request, allowing them to detect echo-back vulnerabilities passively as they browse the application. Third, professional testers use Burp Collaborator extensively for out-of-band testing, particularly for blind XXE, blind SQL injection, and server-side request forgery (SSRF) findings that produce no in-band response.
The Collaborator workflow is conceptually simple but operationally non-obvious. You generate a unique Collaborator subdomain, inject it into a payload sent to the target, and watch Collaborator for inbound DNS or HTTP requests originating from the target. If the target makes a request to your Collaborator subdomain, you have proven that the target executed your payload. CrowdStrike's published research on Log4Shell detection used the same out-of-band methodology, and Microsoft's Azure Defender team has cited Burp Collaborator as one of the standard tools in their penetration-testing playbook.
A senior application security engineer at a major US bank, Ksenia Peguero, formerly at Synopsys and now an independent researcher, has written extensively that the gap between certification-tier Burp users and engagement-tier Burp users is mostly about workflow discipline rather than tool knowledge. The same toolset, applied with deliberate workflow and disciplined note-taking, produces dramatically different results.
What you should not bother learning yet
Three Burp features are technically powerful but rarely necessary at the certification level and not worth optimising for early.
- The Burp REST API. Useful for CI/CD integration, irrelevant for exam-time work.
- Burp Enterprise Edition. A continuous-scanning product unrelated to manual testing certifications.
- Custom Java extensions. The extension API is genuinely powerful but the time investment to write a custom extension is rarely worth it during exam preparation.
Once you have passed your first web-heavy certification and started doing real engagements, these advanced topics become valuable. Until then, depth on Repeater, Intruder, and the extension marketplace produces better return on study time. The pattern that produces consistent exam success is workflow fluency in the core tools, not feature breadth across the full Burp surface area.
See also: OSCP exam strategy: 24-hour lab, How to study for OSCP with limited lab time, OSCP buffer overflow module 2026, Active Directory attacks for cybersecurity cert exams.
References
- PortSwigger. Burp Suite Documentation, version 2024.x. PortSwigger Ltd, 2024.
- PortSwigger. Web Security Academy Lab Catalogue. PortSwigger Ltd, 2024.
- Stuttard, Dafydd and Pinto, Marcus. The Web Application Hacker's Handbook, 2nd Edition. Wiley, 2011.
- OWASP Foundation. OWASP Top 10:2021. OWASP Foundation, 2021.
- NIST Special Publication 800-115. Technical Guide to Information Security Testing and Assessment. National Institute of Standards and Technology, 2008.
- Kettle, James. Smashing the State Machine: The True Potential of Web Race Conditions. PortSwigger Research, 2023.